What’s Vulnerable › Vulnerabilities

CVE-2015-5173

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-10-24 · updated 2026-06-17
• Weakness: CWE-200

Description

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."

Affected products

• Cloud Foundry Cloud Controller cf-release versions prior to v255: before 216 — fixed in 216
• PCF Elastic Runtime: before 1.7.0 — fixed in 1.7.0
• Cloud Foundry UAA: before 2.5.2 — fixed in 2.5.2

How to fix

Upgrade to a fixed version: Cloud Foundry Cloud Controller cf-release versions prior to v255 216; PCF Elastic Runtime 1.7.0; Cloud Foundry UAA 2.5.2. Check the vendor advisory for mitigations.

References

• https://pivotal.io/security/cve-2015-5170-5173
• https://pivotal.io/security/cve-2015-5170-5173

Get alerted when CVE-2015-5173 or the next vulnerability affects your stack